Generally, Internet Behavioral Analytics (IBA) refers to the use of advanced analytics coupled with various networking technologies, to detect anomalies in a network. Such anomalies may include, for example, network attacks, malware, misbehaving and misconfigured devices, and the like. For example, the ability to model the behavior of a device (e.g., a host, networking switch, router, etc.) allows for the detection of malware, which is complimentary to the use of firewalls that use static signature. Observing behavioral changes (e.g., deviation from modeled behavior) using flows records, deep packet inspection, and the like, allows for the detection of an anomaly such as an horizontal movement (e.g. propagation of a malware, . . . ) or an attempt to perform information exfiltration, prompting the system to take remediation actions automatically.
One type of network attack that is of particular concern in the context of computer networks is a Denial of Service (DoS) attack. In general, the goal of a DoS attack is to prevent legitimate use of the services available on the network. For example, a DoS jamming attack may artificially introduce interference into the network, thereby causing collisions with legitimate traffic and preventing message decoding. In another example, a DoS attack may attempt to overwhelm the network's resources by flooding the network with requests, to prevent legitimate requests from being processed. A DoS attack may also be distributed, to conceal the presence of the attack. For example, a distributed DoS (DDoS) attack may involve multiple attackers sending malicious requests, making it more difficult to distinguish when an attack is underway. When viewed in isolation, a particular one of such a request may not appear to be malicious. However, in the aggregate, the requests may overload a resource, thereby impacting legitimate requests sent to the resource.
Botnets represent one way in which a DDoS attack may be launched against a network. In a botnet, a subset of the network devices may be infected with malicious software, thereby allowing the devices in the botnet to be controlled by a single master. Using this control, the master can then coordinate the attack against a given network resource.